Document the now-functional product→profile write path in the payments
guide (set_product_merchant_profile, post-write pattern, picker gating,
double-Option clear). Mark the multi-profile GAP closed, drop the done
work-queue item, and note the discovered set_product_entitlements_catalog
rows_affected gap.
Registry now publishes :55 (universal multi-arch, verified). Public docs
scrubbed of refund copy (Keysat has no refund feature). All 4 StartOS
submission blockers resolved and shipped.
Corrections surfaced by doc-auditor + start9-spec-checker:
- testing.md: api suite 47 -> 54
- payments.md: FK enforcement confirmed at db/mod.rs:29
- startos-packaging.md: publish.sh now ships a universal s9pk
- licensing-tiers.md: record enforce-mode retirement and Creator caps
Refresh Current state for the StartOS submission-blocker work.
Update Current state for the two P1 fixes done this session (source-only,
awaiting :55). Document the advisory settle-amount tripwire in payments.md. Add
Open TODOs: split audit:read into its own scope tier, and build the admin API-keys
management panel (both deferred to later sessions).
Rewrite the Current state section after the merchant-profile bug-fix session and
record that the daemon repo's main tracks GitHub (origin) with a gitea backup,
while root + plans are Gitea-only — check remotes before pushing.
Trim AGENTS.md to whole-repo, every-session facts (154 -> 110 lines) and move
subsystem guidance into docs/guides/*.md, each with paths: frontmatter and a
one-line index entry in AGENTS.md. Symlink each guide from .claude/rules/ so
Claude Code lazy-loads it by matching path; track those symlinks via a
.gitignore exception (.claude/settings.local.json stays ignored).
Agent-onboarding doc for the workspace: stack, build/test/run commands,
directory layout, conventions, and always/never gotchas, plus a Current
state section. CLAUDE.md symlinks to AGENTS.md so Claude Code auto-loads
it. Longer-term backlog lives in ROADMAP.md.
Glue files not covered by subproject repos: top-level docs, logo,
keysat-design-system, and crosscheck tests. Subproject folders are
gitignored (each has its own Gitea remote).
Keysat